Tracing it in the IE8 debugger, what seems to be happening is that the text node stored in ret becomes invalid when the second argument is processed by assigning into div.innerHTML. In 1.2.6 the div was inside the jQuery.each(elems ... function, but in 1.3 it was hoisted out and accessed by closure. When I moved it back inside the function, IE seemed to be satisfied again.